Privacy Policy
Effective date: July 26, 2026
Overview
The short version: your course and simulator progress lives in your own browser, not on our servers (unless you turn on optional sync). Payments are handled entirely by Whop—we never see your card details. We use Google Analytics 4 and Microsoft Clarity to understand how the site is used; Clarity includes session replay, meaning your page interactions (clicks, scrolls, mouse movement) may be recorded. That’s it. We don’t sell your personal information, and we collect as little as we can get away with.
What we collect
- Progress and settings (on your device). Course progress, XP, simulator history, and preferences are stored in your browser’s localStorage. This data stays on your device.
- Optional sync copy. If you use progress sync, a copy of your progress is stored in Netlify Blobs, tied to your access identity, so you can pick up where you left off on another device.
- Sign-in basics. If you sign in with Whop, we receive profile basics such as your Whop user ID and email address—enough to know you have access, nothing more.
- Access cookie. After sign-in we set one cookie, msa_access_v1, which proves your premium access. It is signed, strictly necessary, and never used for advertising.
- Support emails. If you email us, we receive your address and whatever you write.
- Analytics and usage data. Pages visited, device and browser type, approximate location, and interaction recordings via GA4 and Clarity.
How we use it
We use this information to run the platform and nothing sneaky: verifying premium access, saving and syncing your progress, answering support requests, understanding which lessons and features work (and which confuse people), fixing bugs, and keeping the site secure. We do not sell your personal information, and we don’t use your data for third-party advertising.
Cookies & local storage
- msa_access_v1 — strictly necessary. An HMAC-signed cookie set after Whop sign-in that unlocks premium content. Without it, paid access doesn’t work.
- Google Analytics 4 cookies — analytics. Help us measure visits and usage.
- Microsoft Clarity cookies — analytics. Support heatmaps and session replay.
- localStorage — not a cookie, but worth naming: your progress, XP, and settings live here, on your device.
Third-party services
- Whop (payments & identity) — handles checkout, billing, subscriptions, and optional sign-in. We never see or store your card details. Whop privacy policy
- Google Analytics 4 (Google LLC) — site usage analytics. Google privacy policy
- Microsoft Clarity (Microsoft) — heatmaps and session replay: your interactions with pages, such as clicks, scrolling, and mouse movement, may be recorded and replayed so we can improve the experience. Microsoft privacy statement
- Netlify (hosting & progress storage) — hosts the site and stores optional progress sync data in Netlify Blobs. Netlify privacy policy
Data retention
Local progress stays on your device until you clear it. Synced progress in Netlify Blobs is kept while your account has access and deleted on request. The msa_access_v1 cookie expires on its own schedule and is re-issued at sign-in. Support emails are kept as long as needed to help you and for a reasonable period afterward. Analytics data is retained per Google’s and Microsoft’s standard retention settings.
Your rights
If you’re in the EU, EEA, or UK (GDPR / UK GDPR): you have the right to access your personal data, correct it, delete it, receive a portable copy, and object to or restrict certain processing. You also have the right to lodge a complaint with your local supervisory authority.
If you’re in California (CCPA/CPRA): you have the right to know what personal information we collect, to delete it, to correct it, and to opt out of its sale or sharing. To be plain: we do not sell your personal information.
To exercise any of these rights, email support@candlestructurelabs.com. We’ll respond within the timeframe the law requires, and we won’t treat you differently for asking.
Your choices
- Block or delete cookies through your browser settings at any time.
- Clearing your browser’s localStorage (or site data) erases your local progress—so export or sync first if you want to keep it.
- Global Privacy Control: we do not sell or share your personal information for cross-context behavioral advertising, so there is no sale for a GPC signal to opt you out of. You can additionally block analytics cookies through your browser settings.
Children
The service is not directed to children under 13, and we do not knowingly collect personal information from them. Kids Mode is designed for family use under a parent’s account, with an adult holding the subscription and supervising. If you believe a child has provided us personal information, contact us and we’ll delete it.
International visitors
Candle Structure Labs operates from the United States, and data is processed there. If you visit from elsewhere, your information will be transferred to and handled in the United States, where privacy laws may differ from those in your country.
Changes
If we change this policy, we’ll update it here with a new effective date. Material changes will be flagged on the site. Continuing to use the service after a change means you accept the updated policy.
Contact
Questions, requests, or concerns about your privacy: support@candlestructurelabs.com.